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IN THE CLAIMS 
Amended claims follow: 

1 . (Currently Amended) A computer program product stored on a computer-readable 
medium for controlling a computer to scan data accessible via an internet link for 
malware, said computer program product comprising: 

(i) address identifying code operable to identify within currently held data at 
least one internet address associated with said currently held data; 

(ii) retrieving code operable to pre-emptively retrieve via said internet link 
addressed data that would b e. but has not vet been, accessed by a user following said at 
least one internet address , after identifying within said currently held data said at least 
one internet address associated with said currently held data : 

(iii) scanning code operable to pre-emptively scan said addressed dat a that was 
pre-emptiveiv retrieved utilizing said internet link for malware; and 

(iv) storing code operable to store result data identifying at least addressed 
data in which malware was not found; 

wherein said addressed data is cached whefl-&after said addressed data has been 
pre-emptively retrieve d and pre-emptively scanned, but before said addressed data has 
been accessed bv said user , 

2. (Cancelled) 

3 . (Original) A computer program product as claimed in claim 1 , wherein said 
address identifying code is operable to search within said currently held data for string 
data having a format matching a pointer to an internet address. 

4. (Original) A computer program product as claimed in claim 1 , wherein said 
currently held data includes received e-mail messages ► 
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5. (Original) A computer program product as claimed in claim 1 , wherein said 
scanning code is operable to seek to detect within said addressed data one or more of: 

computer viruses; 

worms; 

Trojans; 

banned computer programs; 
banned words; or 
banned images. 

6. (Original) A computer program product as claimed in claim 1 , wherein said 
computer is a firewall computer via which internet traffic is passed to a local computer 
network. 

7. (Cancelled) 

8. (Original) A computer program product as claimed in claim 1, wherein if malware 
is detected within said addressed data, then one or more malware found actions are 
triggered. 

9. (Previously Presented) A computer program product as claimed in claim 1, 
wherein said malware found actions including at least one of: 

(i) preventing access to said currently held data; 

(ii) removing said at least one internet address from said currently held data; 

(iii) preventing access to said addressed data; 

(iv) removing said malware from said addressed data to generate clean 
addressed data and supplying said clean addressed data in place of said addressed data; 

(v) blocking internet access by a computer detected to be seeking to access 
said at least one internet address. 

10. (Currently Amended) A method of scanning data accessible via an internet link 
for malware, said method comprisin g the steps of : 
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(i) identifying within currently held data at least one internet address 
associated with said currently held data; 

(ii) after identifying within said currently held data said at least one internet 
address associated with said currently held data, p re-emptively retrieving via said internet 
link addressed data that would b e. but has not yet been, accessed by a user following said 
at least one internet address; 

(iii) pre-emptively scanning said addressed dat a that was pre-emptively 
retrieved utilizing said internet link for malware; and 

(iv) storing result data identifying at least addressed data in which malware 
was not found; 

wherein said addressed data is cached whes- kafter said addressed data has been 
pre-emptively retrieved and preemptively scanned, but before said addressed data has 
been accessed by said user . 

11. (Cancelled) 

12. (Currently Amended) A method as claimed in claim 10, wherein said step of 
identifying includes searching within said currently held data for string data having a 
format matching a pointer to an internet address. 

13. (Original) A method as claimed in claim 10, wherein said currently held data 
includes received e-mail messages, 

14. (Currently Amended) A method as claimed in claim 10, wherein said atop of 
scanning seeks to detect within said addressed data one or more of: 

computer viruses; 

worms; 

Trojans; 

banned computer programs; 
banned words; or 
banned images. 



PAGE 7/19 1 RCVD AT 312812006 5:58:59 PM [Eastern Standard Time] * SVR:USPTO-EFXRF*2f17 * DNIS:2738300 * CSID:4089714660 ' DURATION (mnvss):04-50 



28.2006 3:1 0PM ZILKA-KOTAB, PC 



NO. 2373 P, 8 



15. (Original) A method as claimed in claim 1 0, wherein said method is performed by 
a firewall computer via which internet traffic is passed to a local computer network. 

16. (Cancelled) 

17. (Original) A method as claimed in claim 10, wherein if malware is detected 
within said addressed data, then one or more malware found actions are triggered. 

18. (Original) A method as claimed in claim 1 0, wherein said malware found actions 
including at least one of: 

(i) preventing access to said currently held data; 

(ii) removing said at least one internet address from said currently held data; 

(iii) preventing access to said addressed data; 

(iv) removing said malware from said addressed data to generate clean 
addressed data and supplying said clean addressed data in place of said addressed data; 

(v) blocking internet access by a computer detected to be seeking to access 
said at least one internet address. 

19. (Currently Amended) Apparatus for scanning data accessible via an internet link 
for malware, said apparatus comprising: 

(i) address identifying logic operable to identify within currently held data at 
least one internet address associated with said currently held data; 

(ii) retrieving logic operable to pre-emptively retrieve via said internet link 
addressed data that would be . but has not vet been, accessed by a user following said at 
least one internet address .after identifying within said currently held data said at least 
one internet address associated with said currently held data ; 

(iii) scanning logic operable to pre-emptively scan said addressed dat a that was 
pre-emptively retrieved utilizing said internet link for malware; and 

(iv) storing logic operable to store result data identifying at least addressed 
data in which malware was not found; 
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wherein said addressed data is cached when i ta fter said addressed data has been 
pre-emptively retrieved and pre-emptively scanned, but before said addressed data has 
been accessed bv said user , 

20. (Cancelled) 

21. (Original) Apparatus as claimed in claim 19, wherein said address identifying 
logic is operable to search within said currently held data for string data having a format 
matching a pointer to an internet address. 

22. (Original) Apparatus as claimed in claim 19, wherein said currently held data 
includes received e-mail messages. 

23. (Original) Apparatus as claimed in claim 19, wherein said scanning logic is 
operable to seek to detect within said addressed data one or more of: 

computer viruses; 

worms; 

Trojans; 

banned computer programs; 
banned words; or 
banned images. 

24. (Original) Apparatus as claimed in claim 1 9, wherein said computer is a firewall 
computer via which internet traffic is passed to a local computer network. 

25. (Cancelled) 

26. (Original) Apparatus as claimed in claim 19, wherein if malware is detected 
within said addressed data, then one or more malware found actions are triggered. 
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27. (Original) Apparatus as claimed in claim 19, wherein said malware found actions 
including at least one of: 

(i) preventing access to said currently held data; 

(ii) removing said at least one internet address from said currently held data; 

(iii) preventing access to said addressed data; 

(iv) removing said malware from said addressed data to generate clean 
addressed data and supplying said clean addressed data in place of said addressed data; 

(v) blocking internet access by a computer detected to be seeking to access 
said at least one internet address. 

28. (Previously Presented) A computer program product as claimed in claim 1, 
wherein said currently held data is an e-mail and said internet address is an internet link 
embedded in said e-mail. 

29. (Previously Presented) A computer program product as claimed in claim 1 , 
wherein said currently held data is a file and said internet address is an internet link 
embedded in said file. 

30. (Previously Presented) A computer program product as claimed in claim 8, 
wherein said malware found actions include removing said at least one internet address 
from said currently held data. 

3 1 . (Previously Presented) A computer program product as claimed in claim 1 , 
wherein addressed data determined to contain malware via said scan is cleaned and said 
clean addressed data is stored locally for access via said internet address. 

32. (Previously Presented) A computer program product as claimed in claim 1, 
wherein access to said addressed data is allowed if said result data associated with said 
addressed data identifies said addressed data as not containing malware and if said 
addressed data has not changed since it was last scanned. 
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33 . (New) A computer program product as claimed in claim 1 , wherein storing said 
result data identifying at least addressed data in which malware was not found includes 
storing said result data in a database with an associated date of last scan and at least one 
of a file size and a checksum associated with said addressed data in which malware was 
not found, 

34. (New) A computer program product as claimed in claim 1 , wherein addressed 
data in which malware was found is cleaned and said clean addressed data is stored 
locally for access via an updated internet address that replaces said internet address. 
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